Hacker News Reader

Comment by jgrowl | Hacker News Reader

I don't hate the idea, but I could never use this while so many sites still have dumb validation rules. It would drive me crazy if I had to remember what sites this didn't work with.

View on HN

Their generation isn't great. They should tweak the resulting password to ensure that it passes most common tests. I think I would enforce

   - 10 characters
   - at least one punctuation
   - at least one digit
   - at least one upper case
   - at least one lower case

By coercing the password to have this form you're losing a trivial amount of entropy, but you'll pass the vast majority of password policies.

Also add a nonce to the password generation (1, 2, 3, 4) so that you can change it if needed or required. No need to remember the nonce, just try a few until you can login.

I don't remember where off the top of my head, but I'm pretty sure I've seen sites that had a "no punctuation in passwords" rule. I think at least one of them was a bank.

Makes sense, it's so their IT department can read it to you more easily over the phone.

Nespresso is one that immediately comes to mind as it's the most recent I've encountered besides my bank. I went to order some pods for my mum as a gift only to discover that their password restrictions were not only draconian but stupid. The moment a site prohibits punctuation (especially single quotes as they did) is the moment I suspect they're storing passwords in plain text.

It's not directly related, but I'm reminded of this Hall of Shame I stumbled upon from some HN comment a few weeks ago: http://plaintextoffenders.com/

PwdHash only puts punctuation in generated passwords if the password you provide has it, so it tries to be smart.

Also, some sites have things like capital letter cannot be the first character. Punctuation can't follow a digit. At most 8 characters... The list goes on.

See my other comment in this subthread about my own version of the deterministic password generator concept. It allows passwords to have site-specific rules for how they're generated and also allows rotating individual site passwords.

Reply on news.ycombinator.com